IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

PostgreSQL: Fix the verify-ca mode (#85530)

Browse Source 
postgres: fix the verify-ca problem
This commit is contained in:
Gábor Farkas 2024-04-09 08:39:45 +02:00 committed by GitHub
parent 4f290ebf99
commit 8a15ed42ae
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/tsdb/grafana-postgresql-datasource/postgres.go
View File

@ -224,6 +224,14 @@ func (s *Service) generateConnectionString(dsInfo sqleng.DataSourceInfo) (string
connStr += fmt.Sprintf(" sslmode='%s'", escape(tlsSettings.Mode)) connStr += fmt.Sprintf(" sslmode='%s'", escape(tlsSettings.Mode))
// there is an issue with the lib/pq module, the `verify-ca` tls mode
// does not work correctly. ( see https://github.com/lib/pq/issues/1106 )
// to workaround the problem, if the `verify-ca` mode is chosen,
// we disable sslsni.
if tlsSettings.Mode == "verify-ca" {
connStr += " sslsni=0"
}
// Attach root certificate if provided // Attach root certificate if provided
if tlsSettings.RootCertFile != "" { if tlsSettings.RootCertFile != "" {
logger.Debug("Setting server root certificate", "tlsRootCert", tlsSettings.RootCertFile) logger.Debug("Setting server root certificate", "tlsRootCert", tlsSettings.RootCertFile)

9
pkg/tsdb/grafana-postgresql-datasource/postgres_test.go
View File

@ -57,6 +57,15 @@ func TestIntegrationGenerateConnectionString(t *testing.T) {
tlsSettings: tlsSettings{Mode: "verify-full"}, tlsSettings: tlsSettings{Mode: "verify-full"},
expConnStr: "user='user' password='password' host='host' dbname='database' sslmode='verify-full'", expConnStr: "user='user' password='password' host='host' dbname='database' sslmode='verify-full'",
}, },
{
desc: "verify-ca automatically adds disable-sni",
host: "host:1234",
user: "user",
password: "password",
database: "database",
tlsSettings: tlsSettings{Mode: "verify-ca"},
expConnStr: "user='user' password='password' host='host' dbname='database' port=1234 sslmode='verify-ca' sslsni=0",
},
{ {
desc: "TCP/port host", desc: "TCP/port host",
host: "host:1234", host: "host:1234",